| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+a7UOPv2B-s2ZrBjc1J8SDA6xRJhOMNepqCFQrB3yE-Yw@mail.gmail.com>
Date: Thu, 25 Feb 2016 10:48:02 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: syzkaller <syzkaller@...glegroups.com>
Cc: David Miller <davem@...emloft.net>,
netdev <netdev@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Jiri Slaby <jslaby@...e.com>, ralf@...ux-mips.org,
Jeff Garzik <jgarzik@...ox.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>
Subject: Re: net: memory leak in mkiss_open
On Thu, Feb 25, 2016 at 10:34 AM, <kn0wns1c@...il.com> wrote:
> hello, can you tell me the kernel number which you fuzz, i test this poc in
> my computer but it does not work.
I've provided kernel version in the original email:
On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).
Attaching my .config to this email as well.
> 在 2016年2月22日星期一 UTC+8下午6:05:32，Dmitry Vyukov写道：
>>
>> Hello,
>>
>> The following program causes memory leak of 6 objects allocated in
>> mkiss_open:
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #include <sys/types.h>
>> #include <sys/stat.h>
>> #include <fcntl.h>
>> #include <sys/ioctl.h>
>> #include <stdlib.h>
>> #include <linux/tty.h>
>>
>> int main(int argc, char **argv)
>> {
>> int fd, val;
>>
>> fd = open("/dev/ptmx", O_RDWR);
>> val = N_AX25;
>> ioctl(fd, TIOCSETD, &val);
>> return 0;
>> }
>>
>>
>> unreferenced object 0xffff8800628991d8 (size 4096):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> 00 00 00 00 00 00 00 00 61 78 30 00 00 00 00 00 ........ax0.....
>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
>> [< inline >] kmalloc include/linux/slab.h:468
>> [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
>> [<ffffffff85551442>] alloc_netdev_mqs+0x82/0xd20 net/core/dev.c:7387
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff8800652b1aa0 (size 96):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> b8 94 89 62 00 88 ff ff b8 94 89 62 00 88 ff ff ...b.......b....
>> 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@..........
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621
>> [< inline >] kmalloc include/linux/slab.h:463
>> [<ffffffff8557a4e2>] __hw_addr_create_ex+0x62/0x240
>> net/core/dev_addr_lists.c:34
>> [<ffffffff8557a7bc>] __hw_addr_add_ex+0xfc/0x270
>> net/core/dev_addr_lists.c:80
>> [< inline >] __hw_addr_add net/core/dev_addr_lists.c:88
>> [<ffffffff8557ac35>] dev_addr_init+0x105/0x1c0
>> net/core/dev_addr_lists.c:371
>> [<ffffffff855514f0>] alloc_netdev_mqs+0x130/0xd20 net/core/dev.c:7400
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff8800620b6a48 (size 512):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> e0 91 89 62 00 88 ff ff 40 20 68 88 ff ff ff ff ...b....@ h.....
>> 40 20 68 88 ff ff ff ff 00 00 00 00 00 00 00 00 @ h.............
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
>> [< inline >] kmalloc include/linux/slab.h:468
>> [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
>> [< inline >] netif_alloc_netdev_queues net/core/dev.c:6870
>> [<ffffffff85551a4c>] alloc_netdev_mqs+0x68c/0xd20 net/core/dev.c:7430
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff88006544ce10 (size 128):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
>> [< inline >] kmalloc include/linux/slab.h:468
>> [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
>> [< inline >] netif_alloc_rx_queues net/core/dev.c:6828
>> [<ffffffff85551bcc>] alloc_netdev_mqs+0x80c/0xd20 net/core/dev.c:7436
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff880062a09860 (size 8):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s)
>> hex dump (first 8 bytes):
>> 61 78 30 00 00 88 ff ff ax0.....
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176ee99>] __kmalloc_track_caller+0x1b9/0x380 mm/slub.c:4068
>> [<ffffffff816bbc89>] kstrdup+0x39/0x70 mm/util.c:53
>> [<ffffffff816bbd06>] kstrdup_const+0x46/0x60 mm/util.c:74
>> [<ffffffff82c3acce>] kvasprintf_const+0x10e/0x160 lib/kasprintf.c:47
>> [<ffffffff82c0cb96>] kobject_set_name_vargs+0x56/0x140
>> lib/kobject.c:265
>> [<ffffffff835aa0d4>] dev_set_name+0xa4/0xc0 drivers/base/core.c:937
>> [<ffffffff855c0eb3>] netdev_register_kobject+0xc3/0x3e0
>> net/core/net-sysfs.c:1531
>> [<ffffffff85571863>] register_netdevice+0x8f3/0xdb0
>> net/core/dev.c:6986
>> [<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098
>> [<ffffffff83ef3f64>] mkiss_open+0x634/0xc30
>> drivers/net/hamradio/mkiss.c:735
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> unreferenced object 0xffff880065785f48 (size 256):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s)
>> hex dump (first 32 bytes):
>> 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
>> ff ff ff ff ff ff ff ff a0 7f cf 89 ff ff ff ff ................
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621
>> [< inline >] kzalloc include/linux/slab.h:463
>> [<ffffffff835ae60d>] device_private_init+0x4d/0x180
>> drivers/base/core.c:993
>> [<ffffffff835af5a3>] device_add+0xe63/0x1480 drivers/base/core.c:1037
>> [<ffffffff855c0f77>] netdev_register_kobject+0x187/0x3e0
>> net/core/net-sysfs.c:1550
>> [<ffffffff85571863>] register_netdevice+0x8f3/0xdb0
>> net/core/dev.c:6986
>> [<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098
>> [<ffffffff83ef3f64>] mkiss_open+0x634/0xc30
>> drivers/net/hamradio/mkiss.c:735
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>>
>>
>> On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).
>
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller+unsubscribe@...glegroups.com.
> For more options, visit https://groups.google.com/d/optout.
Download attachment ".config" of type "application/octet-stream" (138963 bytes)
Powered by blists - more mailing lists